Petty Criminals Have Use Of Sophisticated Hacking Tools
Sophisticated hacking tools and techniques like watering-hole attacks, once used only by nation states or proxies, now increasingly used by criminal hackers, fueling concerns that state-sponsored hackers may have gone rogue.
An eye-opening report from researchers at CyberInt has revealed how existing hacker groups, who were never found to be associated with or sponsored by governments, have started using sophisticated hacking tools and techniques that were once used only by nation states.
The report talks about the possibility of government-backed-hackers going rogue and commercialising their tools and exploits. Considering how powerful and advanced these hacking tools and techniques are, it would be naive for one to believe that it has been developed by hackers who have traditionally used crude malware or employed "smash and grab" techniques aimed at producing quick results.
For example, "watering hole attacks" that were previously carried out by nations like China and Russia are now being launched by various hacker groups.
These attacks involve hackers infiltrating IT systems of targeted organisations or exploiting weaknesses in the defences of third parties such as the target organisation's suppliers, sub-contractors, partners, and clients.
At the same time, hacker groups have also been found utilising Saturn ransomware, a highly sophisticated software that can be distributed via phishing email or other malicious campaigns and used to encrypt files stored in victims' systems. According to CyberInt, Saturn as a Ransomware-as-a-Service (RaaS) affiliate programmes are available on the Dark Web for free.
“These new types of attacks, which started to appear in the latter half of 2017, can be particularly dangerous for corporates as this new breed of OCGs are in it for the long game and will sit within a compromised IT system, carrying out repeated fraud, siphoning off cash and carrying out cyber-espionage,” says Jason Hill, lead research analyst at cyber-security firm CyberInt.
Bill Evans, senior director at security firm One Identity, told SC Magazine UK that even though one can't say with absolute certainty, "it's not difficult to imagine a situation where capabilities once reserved for the sophisticated few are now generally available to the “cyber masses” as this is nature of cyber-warfare and why it is different than traditional warfare.
He added that it is not particularly easy for a cyber-gang to replicate sophisticated hacking tools and techniques, but it is easier for such gangs to copy software or to hire them to carry out their own malicious campaigns.
Giovanni Vigna, CTO and co-founder of Lastline, said: “While it is true that criminal groups have obtained access to increasingly advanced hacking techniques and, in addition, they have been used more sophistication in their attacks, nation-state-sponsored hackers are deemed to have access to caches of 0-days (undisclosed vulnerabilities) and other unique tools and techniques".
As far as defending against enhanced capabilities of hacker groups is concerned, CyberInt says that "companies in all sectors now need to strengthen their cyber-defences in ways previously only thought necessary for organisations such as government contractors.
"This means extending their security perimeters to encompass areas such as social networking and third-parties such as suppliers and clients, who may be largely unaware of the growing sophistication of the OCGs."
The firm adds that senior executives and key staff members need to be trained to protect themselves from hackers who might use their personal details to launch an orchestrated attack on an enterprise.
Enterprises should also liaison with third-parties such as suppliers and sub-contractors to ensure that basic cyber-security protocols such as using encrypted email are followed.
“There is no prescription or silver bullet for “being secure.” In fact, if a security expert believes he or she can make his or her organisation secure, they are fooling themselves. The best a security pro can aim for is to be more secure tomorrow than he / she is today," Evans added.
According to Evans, essential steps to improve an organisation's cyber-security must include controlling, securing and managing privileged accounts, deploying multi-factor authentication, educating employees about phishing attacks, and ensuring that right people have the right access to the right things at the right time.
"Perfect protection is impossible to achieve, but adopting and combining best-of-breed technologies to cover (sometimes with redundancy) the various aspects of security increases the ability to protect. Using one vendor or one solution to cover all facets of the security problem usually results in an increase in risk," said Vigna.
You Might Also Read:
British IT Bosses Fear Sophisticated Cyber Threats:
Mercenary Hackers Funded By Nation-States:
